diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98fb3338..dfe9ac43 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,7 +122,7 @@ jobs:
 
       - name: Install uv for immutable lock check
         if: needs.scope.outputs.code_changed == 'true'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "0.12.5"
           enable-cache: false
diff --git a/public-artifacts.json b/public-artifacts.json
index 15d104b5..1b3f9597 100644
--- a/public-artifacts.json
+++ b/public-artifacts.json
@@ -93,7 +93,7 @@
     },
     {
       "path": ".github/workflows/ci.yml",
-      "sha256": "f2b9a6cb8fced9af463bf3cd50cedaeafcb928baaeb4fc0bc757a3864298a20f"
+      "sha256": "705e4a6a5e3d6169cdc5f5c43b5beae4d158a956010b1d8c2c86c8489dc0e169"
     },
     {
       "path": ".github/workflows/citrix-workspace-standin.yml",
diff --git a/tests/test_ci_workflow_contract.py b/tests/test_ci_workflow_contract.py
index 8408a1f7..b62ba4fe 100644
--- a/tests/test_ci_workflow_contract.py
+++ b/tests/test_ci_workflow_contract.py
@@ -23,7 +23,7 @@ def test_lint_job_rejects_a_stale_dependency_lock() -> None:
     lint_job = workflow[lint_start:compatibility_start]
 
     assert (
-        "uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9" in lint_job
+        "uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d" in lint_job
     )
     assert 'version: "0.12.5"' in lint_job
     assert "run: uv lock --locked" in lint_job